Difference between revisions of "Data unit"
From SleuthKitWiki
(Created initial page.) |
(Added links.) |
||
| Line 2: | Line 2: | ||
The following are the terms that are used by each of the file systems to refer to a data unit. | The following are the terms that are used by each of the file systems to refer to a data unit. | ||
| − | * ExtX: fragment | + | * ExtX: [[fragment]] |
| − | * FAT: sector (note that FAT groups sectors into | + | * FAT: [[sector]] (note that FAT groups sectors into [[cluster]]s, but not all sectors are allocated to a cluster and therefore cluster addresses do not cover the entire file system. TSK uses sector addresses with FAT so that all parts of the file system can be referenced. See [[FAT Implementation Notes]]). |
| − | * FFS: fragment (note that FFS also groups multiple fragments into blocks, but each fragment has an address) | + | * FFS: [[fragment]] (note that FFS also groups multiple fragments into blocks, but each fragment has an address) |
| − | * HFS: block | + | * HFS: [[block]] |
| − | * NTFS: cluster | + | * NTFS: [[cluster]] |
Revision as of 07:00, 4 January 2010
Data unit is the generic term used in TSK to refer to a grouping of consecutive sectors. Sectors are typically 512-bytes and file systems group them together to form larger storage units. For example, they may group 8 consecutive 512-byte sectors together to form units that are 4096-bytes each. The file system assigns an address to each of these data units. Typically, the file system does not provide an address to each sector. It only allocates and refers to the data units.
The following are the terms that are used by each of the file systems to refer to a data unit.
- ExtX: fragment
- FAT: sector (note that FAT groups sectors into clusters, but not all sectors are allocated to a cluster and therefore cluster addresses do not cover the entire file system. TSK uses sector addresses with FAT so that all parts of the file system can be referenced. See FAT Implementation Notes).
- FFS: fragment (note that FFS also groups multiple fragments into blocks, but each fragment has an address)
- HFS: block
- NTFS: cluster
